ijvo/google

Licensecaution

The manifest declares BSD-3-Clause and GPL licenses, while artifact license files were detected as BSD-3-Clause and MIT. The package is licensed, but the mismatch reduces licensing clarity.

Release historycaution

The package has 21 releases since April 2018, but none in the last 12 months; the latest release was over a year ago. This indicates materially slowed maintenance despite a previously regular release interval.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Its last push coincided with the assessed release, so there is little evidence of ongoing maintenance after publication.

Security policycaution

The repository has no security policy. This is a transparency gap for reporting vulnerabilities, though it does not by itself show that the package is unsafe to depend on.

Workflow auditcaution

All three workflows were analyzed successfully and have no untrusted checkout or script-injection findings, but all nine action references are unpinned. The absence of a top-level permissions block is acceptable on its own, while unpinned actions remain a supply-chain hygiene gap.